Methods systems and apparatuses for dynamically tagging vlans

ABSTRACT

Systems, mechanisms, apparatuses, and methods are disclosed for dynamically tagging VLANs. For example, in one embodiment such means include: means for receiving a packet having identified therein a source Media Access Control (MAC) address and a Virtual Local Area Network (VLAN) Identifier, wherein the VLAN identifier corresponds to a VLAN which is non-existent on a network switch; means for modifying the packet received to include two VLAN tags, a first VLAN tag corresponding to the VLAN identifier identified within the packet received and a second VLAN tag, distinct from the first; means for determining no forwarding database entry exists for the modified packet; and means for creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

TECHNICAL FIELD

Embodiments relate generally to the field of networking, and moreparticularly, to methods, systems, and apparatus for dynamically taggingVirtual Local Area Networks (VLANs).

BACKGROUND

The subject matter discussed in the background section should not beassumed to be prior art merely as a result of its mention in thebackground section. Similarly, a problem mentioned in the backgroundsection or associated with the subject matter of the background sectionshould not be assumed to have been previously recognized in the priorart. The subject matter in the background section merely representsdifferent approaches, which in and of themselves may also correspond toclaimed embodiments.

A virtual local area network (“virtual LAN” or “VLAN,” is a group ofhosts with a common set of requirements, which communicate as if theywere attached to the same broadcast domain, regardless of their physicallocation. A VLAN has the same attributes as a physical local areanetwork (LAN), but it allows for end stations to be grouped togethereven when not on the same network switch.

Physically replicating the functions of a VLAN would ordinarily requireseparate and parallel collections of network cables and equipmentseparate from the primary network, a prospect which is costly andcomplex. Unlike a physically separate network, VLANs share bandwidth aspayload traverses the same underlying physical connections. For example,two separate one-gigabit VLANs that share a single one-gigabitinterconnection will encounter reduced throughput and increasedcontention and network congestion due to such a sharing arrangement,with the benefit of not having to physically reproduce networkinfrastructure.

Common network behaviors such as configuring switch ports, taggingframes when entering VLAN, looking up MAC tables to switch/flood framesto trunk links, and untagging when exit from VLAN are virtualized byVLAN compatible components.

Conventional VLANs are configured and established in advance, forexample, by a network administrator, using VLAN compatible components.

A dynamic VLAN is a VLAN which is automatically created by a networkswitch and provisioned upon receipt and processing of a packet from anetwork interface. Unlike conventional VLANs, dynamic VLANs do not enjoya well supported standard and, to date, multiple vendors have attemptedto solve the problem of supporting dynamic VLANs through a variety ofapplications, with varying degrees of functionality and compatibility.

While work has advanced to some degree in the area of dynamic VLANs,current implementations are limited to supporting only untagged dynamicVLANs. Conventional solutions use a dummy or catcher VLAN for aspecified port and upon encountering an untagged packet, a VLANassignment will be established. However, this results in an untaggedpacket being assigned to a VLAN before it is actually a member of theVLAN. Conversely, tagged VLANs need to be pre-configured before theinitial packet processing can occur, which defeats the purpose of thedynamic VLAN feature, and renders support for dynamic VLANs useless whenpackets associated with tagged VLANs are encountered.

The present state of the art may therefore benefit from the methods,systems, and apparatuses for dynamically tagging VLANs as is describedherein.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments are illustrated by way of example, and not by way oflimitation and can be more fully understood with reference to thefollowing detailed description when considered in connection with thefigures in which:

FIG. 1 illustrates an exemplary architecture in accordance with whichembodiments may operate;

FIGS. 2A, 2B, and 2C illustrate exemplary process flows for dynamicallytagging Virtual Local Area Networks (VLANs) in accordance with whichembodiments may operate;

FIG. 3 illustrates an alternative exemplary process flow for dynamicallytagging VLANs in accordance with which embodiments may operate;

FIG. 4 illustrates an exemplary architecture of a network switch inaccordance with which embodiments may operate; and

FIG. 5 illustrates an alternative exemplary architecture of a networkswitch to receive an integrated circuit in accordance with whichembodiments may operate.

DETAILED DESCRIPTION

Described herein are systems, apparatuses, and methods for dynamicallytagging VLANs. In accordance with one embodiment, such means include:means for receiving a packet having identified therein a source MediaAccess Control (MAC) address and a Virtual Local Area Network (VLAN)Identifier, wherein the VLAN identifier corresponds to a VLAN which isnon-existent on a network switch; means for modifying the packetreceived to include two VLAN tags, a first VLAN tag corresponding to theVLAN identifier identified within the packet received and a second VLANtag, distinct from the first; means for determining no forwardingdatabase entry exists for the modified packet; and means for creatingthe VLAN on the network switch to handle received packets tagged withthe VLAN identifier. An SVID tag refers to a “Service VLAN Identifiertag.”

In the following description, numerous specific details are set forthsuch as examples of specific systems, languages, components, etc., inorder to provide a thorough understanding of the various embodiments. Itwill be apparent, however, to one skilled in the art that these specificdetails need not be employed to practice the disclosed embodiments. Inother instances, well known materials or methods have not been describedin detail in order to avoid unnecessarily obscuring the disclosedembodiments.

In addition to various hardware components depicted in the figures anddescribed herein, embodiments further include various operations whichare described below. The operations described in accordance with suchembodiments may be performed by hardware components or may be embodiedin machine-executable instructions, which may be used to cause ageneral-purpose or special-purpose processor programmed with theinstructions to perform the operations. Alternatively, the operationsmay be performed by a combination of hardware and software.

Embodiments also relate to an apparatus for performing the operationsherein. This apparatus may be specially constructed for the requiredpurposes, or it may comprise a general purpose computer selectivelyactivated or reconfigured by a computer program stored in the computer.Such a computer program may be stored in a computer readable storagemedium, such as, but not limited to, any type of disk including floppydisks, optical disks, CD-ROMs, and magnetic-optical disks, read-onlymemories (ROMs), random access memories (RAMs), EPROMs, EEPROMs,magnetic or optical cards, or any type of media suitable for storingelectronic instructions, each coupled to a computer system bus.

The algorithms and displays presented herein are not inherently relatedto any particular computer or other apparatus. Various general purposesystems may be used with programs in accordance with the teachingsherein, or it may prove convenient to construct more specializedapparatus to perform the required method steps. The required structurefor a variety of these systems will appear as set forth in thedescription below. In addition, embodiments are not described withreference to any particular programming language. It will be appreciatedthat a variety of programming languages may be used to implement theteachings of the embodiments as described herein.

Embodiments may be provided as a computer program product, or software,that may include a machine-readable medium having stored thereoninstructions, which may be used to program a computer system (or otherelectronic devices) to perform a process according to the disclosedembodiments. A machine-readable medium includes any mechanism forstoring or transmitting information in a form readable by a machine(e.g., a computer). For example, a machine-readable (e.g.,computer-readable) medium includes a machine (e.g., a computer) readablestorage medium (e.g., read only memory (“ROM”), random access memory(“RAM”), magnetic disk storage media, optical storage media, flashmemory devices, etc.), a machine (e.g., computer) readable transmissionmedium (electrical, optical, acoustical), etc.

Any of the above embodiments may be used alone or together with oneanother in any combination. Although various embodiments may have beenpartially motivated by deficiencies with conventional techniques andapproaches, some of which are described or alluded to within thespecification, such embodiments need not necessarily address or solveany of these deficiencies, but rather, may address only some of thedeficiencies, address none of the deficiencies, or be directed towarddifferent deficiencies and problems where are not directly discussed.

Conventional solutions for dynamic VLANs are limited to supporting onlyuntagged dynamic VLANs with tagged VLANs requiring pre-configuration ofa desired VLAN before the initial packet processing for a tagged VLANscan occur, thus rendering support for dynamic VLANs useless when packetsassociated with tagged VLANs are encountered.

Accordingly, taught herein are solutions for dynamically tagging VLANssuch that they may be accommodated by dynamic VLAN functionality, andspecifically so that already tagged VLANs lacking a pre-configurationfor initial packet processing can be accommodated by a network switchwhich automatically creates and provisions a dynamically generated VLANresponsive to receipt and processing of an already tagged VLAN packetfrom a network interface.

FIG. 1 illustrates an exemplary architecture 100 in accordance withwhich embodiments may operate and more specifically, illustrates theproblem of dynamic VLAN creation in the context of already tagged VLANpackets.

The architecture 100 depicts a network 110 communicatively interfaced toeach of two switches, switch 1 105A via ports P3 and P4 and further inwhich the network is communicatively interfaced with switch 2 105B viaports P2 and P3. Switch 1 105A in turn is communicatively interfaced toPhysical Servers (PS), including each of PS1 120A via port P1 and PS2120B via port P2 while switch 2 105B is communicatively interfaced toPS3 120C via port P1.

When encountering untagged VLANs for which no pre-configuration exists,a “catcher” dummy VLAN is established having a sole responsibility tosend notifications indicating when such packets are received on targetedinterfaces. Processing logic then proceeds with necessary functions,such as authentication, after which a capable switch will dynamicallycreate and configure appropriate access to the dynamically created VLANor VLANs designated by the packet processing.

Tagged VLANs, on the other hand, require a different solution. Forinstance, consider the architecture 100 depicted at FIG. 1 when VirtualMachine 1 (VM1) 101 tagged traffic needs to be classified to VLAN “RED,”and switch 2 105B lacks a VLAN “RED” pre-configuration. When VM1 101transitions to PS3 120C (as indicated by the hashed arrow VM1 transitionevent 102 transitioning VM1 101 at PS1 120A to PS3 at 120C), the problemarises that switch 2 105B has no mechanism whatsoever to detect VM1's101 MAC when the VLAN “RED” pre-configuration does not already exist.The problem therefore is how to enable switch 2 105B to correctly detectthe MAC for VM1 101 in the absence of a VLAN “RED” pre-configurationwhen such transition from PS1 120A to PS3 120C occurs.

According to certain embodiments, a dynamic VLAN feature set may beimproved to enable dynamically tagging VLANs so that already taggedVLANs may nevertheless be supported by dynamic VLAN capable networkdevices. For example, Extreme Network's XNV™ (ExtremeXOS NetworkVirtualization) Dynamic VLAN feature set may be so enabled through theimprovements which are taught herein.

According to certain embodiments, dynamic VLAN support may be enabledfor specifically identified ports of a network switch 105A-B. Forexample, the switches 105A-B may be configured to allow for alreadytagged traffic on each of one or more ports, based on the operationspresented within the following process flow to accommodate alreadytagged VLAN traffic.

FIGS. 2A, 2B, and 2C illustrate exemplary process flows 201, 202, and203, for dynamically tagging Virtual Local Area Networks (VLANs) inaccordance with which embodiments may operate.

The method established by process flows 201, 202, and 203 may beperformed by processing logic that may include hardware (e.g.,circuitry, dedicated logic, programmable logic, microcode, etc.),software (e.g., instructions run on a processing device to performvarious operations such receiving, forwarding, determining, processing,comparing, and transmitting packets, frames, and data), or somecombination thereof. For example, a network switch having a CentralProcessing Unit (CPU) to perform the operations and memory to store theoperations may be so enabled. Some of the blocks and/or operationslisted below are optional in accordance with certain embodiments. Thenumbering of the blocks presented is for the sake of clarity and is notintended to prescribe an explicit order of operations in which thevarious blocks must occur.

At FIG. 2A, the method illustrated by process flows 201, 202, and 203begins with processing logic at flow 201 for creating an internal VMANand designating the referenced ports as “untagged” at block 205. Aninternal VMAN is created using a multiple VLAN header context with atechnique known in the technical arts as provider bridging, stackedVLANs, QinQ or Q-in-Q as supported by the IEEE 802.1ad Ethernetnetworking standard (referred to also as the IEEE 802.1QinQ standard).Whereas the original 802.1Q specification allowed for only a single VLANheader to be inserted into an Ethernet frame, the extended 802.1QinQfunctionality supported by 802.1ad allows for multiple VLAN headers tobe inserted into a single frame. In the context of multiple VLANheaders, the term “VLAN tag” represents an “802.1Q VLAN header.”

With the use of QinQ functionality, multiple VLAN tags in an Ethernetframe constitute a tag stack and a QinQ frame that has 2 VLAN 802.1Qheaders is double-tagged, forming the tag stack. In a tag stack, pushand pop operations are performed at the “outer” tag end of the stack,and thus, a tag added by a tag push operation becomes a new “outer” tag,thus causing an already present tag to become an “inner” tag. A tag popoperation will remove a current “outer” tag from the tag stack, thusmoving a next “inner” tag to the “outer” tag position. In accordancewith one embodiment to support the creation of an internal VMAN, anouter tag SVID is added to the packet (e.g., an SVID tag is “pushed”onto the Ethernet frame) and an already present CVID tag of the packetis then moved to an “inner” position within the Ethernet frame.

At block 210, processing logic enables software L2-MAC-Learning (Layer 2Media Access Control address learning) mode for the referenced ports.Ordinarily, hardware learning mode is applied by default, but accordingto the described embodiment, enabling L2-MAC-Learning provides for asoftware learning mode within a network switch which allows for theconsideration and application of policies during the enabled learningprocess. Operations 205 and 210 may be considered as switchconfiguration operations for a compatible network switch to supportdynamically tagging VLANs and dynamic VLAN creation using already taggedVLAN packets.

Flow then proceeds to processing logic at block 215 for receiving, at aconfigured switch, a tagged packet from a tagged VLAN.

Processing logic at block 216 classifies the packet as belonging to theVMAN (SVID).

Processing logic at block 217 modifies the packet via the previouslyenabled L2-MAC-Learning processing to contain two VLAN tags, an innertag and an outer tag. For example, the outer tag SVID may be added tothe packet corresponding to a Service-VID or SVID and the inner tag mayadded to the packet corresponding to a Customer-VID or CVID.

At block 220, processing logic performs a source address MAC+SVID lookup(“MAC-SA+SVID”) and at decision point 222 it is determined whether ornot the lookup fails. According to the described embodiment, thereceived packet has already been classified as belonging to the VMAN(SVID) before reaching operation 220. In such an embodiment, theMAC-SA+SVID lookup search key is characterized as the MAC-SA[48bits]+SVID[12 bits], and thus, makes no reference to the tagged VLANfrom the wire in fulfillment of the MAC lookup operation. If “no,” thelookup does not fail, then processing ends.

If “yes,” the lookup does fail at decision point 222, then flow proceedsto flow 202 through block 223 indicating the MAC FDB address entry isunknown and to proceed to operations for dynamically creating a VLAN fora tagged packet.

At FIG. 2B, flow 202 begins at block 250 indicating that the MAC-SA+SVIDlookup has failed in flow 201.

Flow then proceeds to processing logic at block 255 for sending themodified packet, including both VIDs to the previously enabled softwareL2-MAC-Learning process, for example, as enabled by a compatible CPU,circuit, or processor of a network switch, etc. Processing of themodified packet via the software L2-MAC-Learning process may, forexample, reference a 12-bit VMAN identifier (SVID) associated with theinternal VMAN created and setup during internal configuration of theswitch (at flow 201, block 205) in which the internal VMAN was createdwith the referenced ports as “untagged.”

At block 265, processing logic learns, via the L2-MAC-Learningprocessing, the MAC address in conjunction with the internal VMANcreated in the switch configuration operations for the designated ports.

At block 275, processing logic receives and processes a learnnotification from the L2-MAC-Learning processing indicating the new CVIDMAC FDB entry.

At block 280, processing logic distributes the newly learned MAC entryvia L2-MAC-Learning processing, including distribution of the new CVIDMAC FDB entry to other modules within the network element.

At block 285, processing logic receives the newly learned CVID MAC FDBentry and cross references it to an associated Virtual Port Profile(VPP) so as to determine validity.

At block 290, processing logic validates whether or not the CVID is avalid dynamic tagged VLAN based on the newly learned CVID MAC FDB entryand the associated VPP and at decision point 292, it is determinedwhether or not the CVID is a valid dynamic tagged VLAN.

If “no,” the CVID is not a valid dynamic tagged VLAN, then processingends due to the failed validity test of the CVID against the VirtualPort Profile. For example, a policy or profile may dictate the packetsimply is dropped. The Virtual Port Profile may be stored locally withina compatible network switch or may be retrieved on an ad-hoc basis from,for example, a network management station having centralized profileresponsibility for the switches.

Conversely, if “yes,” the CVID is a valid dynamic tagged VLAN, thenprocessing proceeds FIG. 2C which sets forth the dynamic VLAN creationoperations of flow 203.

At FIG. 2C, flow 203 begins at block 293 indicating that the CVID hasbeen validated as a dynamic tagged VLAN at flow 202 and that the VLANshould be dynamically created.

At block 294, processing logic dynamically creates the tagged VLAN andfurther adds the associated port as tagged so that subsequent taggedpackets can be forwarded via the appropriate broadcast domain.

At block 295, processing logic creates a MAC FDB entry on thedynamically created tagged VLAN.

At block 296, processing logic distributes the MAC FDB entry for thedynamically created tagged VLAN to other modules within the networkelement.

And at block 297, processing logic deletes the MAC FDB entry from theinternal VMAN created at flow 202. Processing logic deletes the MAC FDBentry because all new packets coming in will be handled with the 802.1Qtag as their source MAC and VLAN tag will already be known. It isnecessary to delete the MAC FDB entry from the internal VMAN so as toallow for a change in the tag at some point in the future. For example,where the first packet for a tagged VLAN is processed according to thedescribed flow, by deleting the MAC FDB entry from the internal VMAN,any change to that tag in the future can trigger the first packetreceived for a tagged VLAN to again be subjected to the same processing,where the appropriate VLAN may be again discovered, without erroneouslymatching due to a stale MAC FDB entry on the internal VMAN. However,deletion and rediscovery can be controlled by policy or profiles so asto prevent such rediscovery if necessary.

Moreover, multiple VLANs may exist on the same port of a network switchhaving separation for various services, such as voice, data, etc.Separate customers may also be supported through multiple VLANs on thesame port as the VLANs operating as logical broadcast domains asexplained above. Accordingly, it is permissible to have a single portwith multiple VLANs overlaid thereupon, including those corresponding todistinct customers and/or services.

The operational blocks 293 through 297 are thus part of processing fordynamic VLAN creation for a first tagged packet received which isreached after the failed lookup determination at decision point 222 offlow 201 and the successful validity determination of decision point 292at flow 202.

From processing block 297, processing returns to flow 201 whereadditional packets may be received and processed in an iterativefashion. Because subsequent tagged packets having the same source MACaddress received from the same VLAN are now known, they will be properlyassigned to the tagged VLAN indicated which was dynamically created viathe processing above and then forwarded pursuant to a hit on the MACaddress according to the destination lookup sequence. A newly receivedtagged packet for a VLAN which still requires dynamic creation (e.g., afirst packet of a newly tagged VLAN) will similarly be subjected to thenecessary processing and checks according to the flow established aboveso as to establish the appropriate forwarding means through dynamic VLANcreation for already tagged VLAN packets.

FIG. 3 illustrates an alternative exemplary process flow 300 fordynamically tagging VLANs in accordance with which embodiments mayoperate.

The method set forth by flow 300 begins with processing logic at block305 for creating a tagged VMAN utilizing 802.1ad providerbridging/stacked VLAN functionality, thus forming a packet catcher at anetwork switch for packets received having identified therein any VLANidentifier which specifies any VLAN which is non-existent on the networkswitch. This operation configures the switch to accept tagged VLANpackets which are directed toward a yet to be assigned VLAN.

Processing logic at block 310 receives a packet having identifiedtherein a source Media Access Control (MAC) address and a Virtual LocalArea Network (VLAN) Identifier for which the VLAN identifier correspondsto a VLAN which is non-existent on the network switch. For example, afirst packet among a stream of packets directed to the same identifiedVLAN will be subject to the special processing where it is caught by theVMAN or queue in queue (Q-in-Q) as a single 802.1Q queued packet and isthen treated as an unqueued packet.

Processing logic at block 315 modifies the packet received to include anSVID tag (Service VLAN Identifier tag) associated with the tagged VMANor Q-in-Q packet catcher in addition to a CVID (customer VLAN Identifiertag) already included with the packet received. Thus, any time there isa dynamic VLAN tag anticipated, an internal VMAN on the ingress port canbe utilized as a catcher for the packet lacking an appropriatelypre-assigned VLAN for the corresponding VLAN tag of the packet. Themodification thus associates the source MAC address and the CVID tag.Software learning may look at control bits passed from hardware into abuffer structure and queue the operation for processing logic topopulate the MAC forwarding database, for example, by adding a CVID tagentry into the MAC forwarding database. Rather than using the VLAN IDand the source MAC as the key to the forwarding database, packetlearning functionality instead will utilize the associated SVID tagderived from the VMAN packet catcher along with the learned source MACaddress for the packet as the key.

The CVID tag entry introduced to the forwarding database is distributedalong with the MAC learning portion to other modules within the networkelement (e.g., the switch having the processing logic, etc.) and the MACaddress and is cross referenced to an outside policy or profile, such asa Virtual Port Profile (VPP) which then further validates whether theCVID portion distributed with the learned source MAC is a valid tag incompliance with the policy or profile for the requested configuration.Through this process, the source MAC address and tagged VLAN are thenassociated via the CVID.

At block 320 processing logic then determines that no forwardingdatabase entry exists.

Processing logic at block 330 then creates the VLAN on the networkswitch to handle received packets tagged with the VLAN identifier. TheVLAN created is the tagged VLAN for the packet which was previouslynon-existent on the network switch, but is now dynamically created tohandle packets having the VLAN Identifier indicated by the firstreceived packet. A VLAN manager may be utilized to create the new VLANwhich then adds the associated ingress port for the packet as tagged andfurther distributes the information down into the hardware of thenetwork switch so as to enable hardware based port membership handlingfor packets. New packets that arrive with the 802.1Q VLAN tag and theCVID tag can therefore be handled by the port membership hardware forthe VLAN and the port combination, thus resulting in hardware handlingand forwarding rather than processing through the dummy VMAN catcher.Thus, while the first packet is classified as belonging to the VMAN andnot to the VLAN specified due to a lack of the VLAN on the networkswitch, subsequent packets will encounter normal processing for analready known and established VLAN corresponding to their VLANidentifier.

Processing logic at block 335 creates a MAC entry in the forwardingdatabase for the VLAN created and processing logic at block 340distributes the MAC entry for the VLAN created to other modules withinthe network element.

In accordance with one embodiment, there is a non-transitory computerreadable storage medium having instructions stored thereon that, whenexecuted by a processor of a network switch, the instructions cause thenetwork switch to perform operations including: receiving a packethaving identified therein a source Media Access Control (MAC) addressand a Virtual Local Area Network (VLAN) Identifier, wherein the VLANidentifier corresponds to a VLAN which is non-existent on the networkswitch; determining no forwarding database entry exists for the sourceMAC address of the packet received; modifying the packet received toinclude two VLAN tags, a first VLAN tag corresponding to the VLANidentifier identified within the packet received and a second VLAN tag,distinct from the first; and creating the VLAN on the network switch tohandle received packets tagged with the VLAN identifier. In oneembodiment, the instructions further cause the network switch to performoperations including creating a tagged Virtual Metro Area Network (VMAN)packet catcher at the network switch for packets received havingidentified therein any VLAN identifier which specifies any VLAN which isnon-existent on the network switch; and modifying any packet received bythe tagged VMAN packet catcher to include an SVID tag (Service VLANIdentifier tag) in addition to a CVID (customer VLAN Identifier tag)already included with such packets.

FIG. 4 illustrates an exemplary architecture 400 of a network switch 415in accordance with which embodiments may operate. The switch depictedincludes a memory 405, processor 410, switch logic 420, four physicalports 425A and 425B indicated as ingress ports and 425C and 425D leadingto one or more other network elements 480. Network switch 415 furtherincludes a hardware MAC address search circuit 435, a MAC FDB 450, apacket catcher 455, and a software L2-MAC-Learning 445 component.

In accordance with one embodiment, the network switch 415 having thereinthe memory 405 to store processing logic (e.g., switch logic 420) andthe processor 410 to execute processing logic or switch logic 420utilizes its ingress port 425A to receive a packet 490 having identifiedtherein a source Media Access Control (MAC) address and a Virtual LocalArea Network (VLAN) Identifier, in which the VLAN identifier correspondsto a VLAN which is non-existent on the network switch. SoftwareL2-MAC-Learning 445 component is to modify the packet received toinclude two VLAN tags, a first VLAN tag corresponding to the VLANidentifier identified within the packet received and a second VLAN tag,distinct from the first thus associating the source MAC address and theVLAN identifier of the received packet with the second VLAN tag. Ahardware MAC address search circuit 435 of the network switch 415 is todetermine that no forwarding database entry exists for the source MACaddress of the packet received. Processing logic or switch logic 420further creates the VLAN on the network switch to handle receivedpackets tagged with the VLAN identifier.

In one embodiment, the ingress port 425A of the network switch 415 isserviced by a tagged Virtual Metro Area Network (VMAN) packet catcher455 at the network switch 415 for packets 490 received having identifiedtherein any VLAN identifier which specifies any VLAN which isnon-existent on the network switch. In one embodiment, the softwareL2-MAC-Learning 445 component modifies any packet received by the taggedVMAN packet catcher 455 to include an SVID tag (Service VLAN Identifiertag) in addition to a CVID (customer VLAN Identifier tag) alreadyincluded with such packets that are received. According to oneembodiment, the software L2-MAC-Learning 445 component is added to theExtreme Network XNV™ (ExtremeXOS Network Virtualization) Dynamic VLANfeature set.

In one embodiment, the tagged VMAN packet catcher 455 services one ormore untagged ingress ports 425A-B of the network switch 415 and networklayer 2 MAC address learning mode is enabled for the one or more ingressports 425A-B via the software L2-MAC-Learning 445 component.

In one embodiment, port membership hardware 465 for the ingress port425A is to handle port forwarding for any packet subsequent to thepacket received having a VLAN identifier and ingress port combinationmatching that of the packet 490 initially received.

FIG. 5 illustrates an alternative exemplary architecture 500 of a hostnetwork switch 515 to receive an integrated circuit 511B in accordancewith which embodiments may operate.

In accordance with the disclosed embodiments, network switch 515 may beenabled to perform the disclosed functions via a memory 405 to store,and a processor 410 to execute logic blocks 520 as discussed above withrespect to FIG. 4. In alternative embodiments, network switch 515 isenabled to perform the disclosed functions via a specialized integratedcircuit 511B which is designed to perform the disclosed operations. Forexample, in one embodiment, a network switch 515 includes an integratedcircuit (IC) 511A having a plurality of logic blocks 520 and additionalcircuitry capable to store and execute appropriate functions.

For example, integrated circuit 511A according to one embodimentincludes an input 512 to receive a packet having identified therein asource Media Access Control (MAC) address and a Virtual Local AreaNetwork (VLAN) Identifier, wherein the VLAN identifier corresponds to aVLAN which is non-existent within a host network switch 515; a hardwareMAC address search circuit 513 to determine that no forwarding databaseentry exists for the source MAC address of the packet received; and aL2-MAC-Learning component 514 to modify the packet received to includetwo VLAN tags, a first VLAN tag corresponding to the VLAN identifieridentified within the packet received and a second VLAN tag, distinctfrom the first. According to such an embodiment, a first logic block 520of IC 511B is to associate the source MAC address and the VLANidentifier of the received packet with the second VLAN tag and a secondlogic block 520 is to create the VLAN within the host network switch 515to handle received packets tagged with the VLAN identifier.

Further still, Integrated Circuit 511B is depicted as yet to beinstalled into a network switch 515. Yet to be installed IntegratedCircuit 511B nevertheless retains its plurality of logic blocks 520circuitry elements 512, 513, and 514, and logic capable to store andexecute appropriate functions as described above with regard to the IC511A which is depicted as having been installed within host networkswitch 515.

Such an IC 511A and 511B may be designed as a System On a Chip (SOC)integrated circuit; designed as a Field-programmable Gate Array (FPGA)integrated circuit; designed as an Application-Specific IntegratedCircuit (ASIC); or designed as a Programmable Logic Device (PLD)integrated circuit. The IC 511A and 511B may further include an input512 and an output, each adapted to be physically coupled with acommunications bus of the host switch, such as a network switch 515.

Certain functionality described herein may be performed by hardwarizedor hardware implemented logic units or modules. For example, a hardwarebased packet forwarder, a hardware based Media Access Control (MAC)address lookup, a hardware based packet modifier capable to add and edittags of a packet subject to processing, and/or a hardware VMAN and VLANtag determiner (e.g., such as a hardware multiplexer) configured with orwithin a CPU processor and accompanying memory of a networking device,network switch, and so forth, are in accordance with the embodimentdescribed herein.

While embodiments have been described by way of example and in terms ofthe specific embodiments, it is to be understood that the invention isnot limited to the disclosed embodiments. To the contrary, it isintended to cover various modifications and similar arrangements aswould be apparent to those skilled in the art. Therefore, the scope ofthe appended claims should be accorded the broadest interpretation so asto encompass all such modifications and similar arrangements. It is tobe understood that the above description is intended to be illustrative,and not restrictive. Many other embodiments will be apparent to those ofskill in the art upon reading and understanding the above description.The scope of the invention is therefore determined in reference to theappended claims, along with the full scope of equivalents to which suchclaims are entitled.

What is claimed is:
 1. A method in a network switch having a processor and a memory therein, wherein the method comprises: receiving a packet having identified therein a source Media Access Control (MAC) address and a Virtual Local Area Network (VLAN) Identifier, wherein the VLAN identifier corresponds to a VLAN which is non-existent on the network switch; modifying the packet received to include two VLAN tags, a first VLAN tag corresponding to the VLAN identifier identified within the packet received and a second VLAN tag, distinct from the first; determining no forwarding database entry exists for the modified packet; and creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier.
 2. The method of claim 1, further comprising: creating a tagged Virtual Metro Area Network (VMAN) packet catcher at the network switch for packets received having identified therein any VLAN identifier which specifies any VLAN which is non-existent on the network switch; and modifying any packet received by the tagged VMAN packet catcher to include an SVID tag (Service VLAN Identifier tag) in addition to a CVID (customer VLAN Identifier tag) already included with such packets.
 3. The method of claim 2, wherein the tagged VMAN packet catcher prevents the network switch from dropping packets having been tagged with a VLAN identifier for which no corresponding VLAN exists on the network switch due to a lack of forwarding information to the non-existent VLAN.
 4. The method of claim 1, further comprising: configuring the network switch to support dynamic VLAN allocation for received packets having a VLAN tag identifying a non-existent VLAN of the network switch, wherein the configuring comprises at least: (a) creating an internal Virtual Metro Area Network (VMAN) for one or more ingress ports of the network switch; (b) designating the one or more ingress ports as untagged ports; and (c) enabling layer 2 MAC address learning mode for the one or more ingress ports to perform the modifying operation.
 5. The method of claim 1, wherein modifying the packet further comprises associating the source MAC address and the VLAN identifier with the second VLAN tag.
 6. The method of claim 1, wherein receiving the packet comprises: receiving the packet at an ingress port of the network switch configured with a packet catcher for VLAN tagged packets identifying any non-existent VLAN within the network switch; and wherein creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier comprises configuring the ingress port of the network switch as tagged for the created VLAN so that subsequent packets tagged with the VLAN identifier will be handled by port membership hardware for the ingress port based on a combination of the VLAN identifier and ingress port used by the subsequent packets.
 7. The method of claim 1, wherein determining no forwarding database entry exists comprises: a hardware MAC address search circuit to perform a lookup and indicate a no entry result, wherein the lookup comprises a search key characterized by MAC-SA+SVID including a MAC source address of the packet and an SVID tag (Service VLAN Identifier tag), introduced to the packet when modified.
 8. The method of claim 7, wherein modifying the packet received to include two VLAN tags comprises software L2-MAC-Learning to modify the packet responsive to the hardware MAC address search circuit indicating the no entry result.
 9. The method of claim 1, wherein modifying the packet received to include two VLAN tags comprises: modifying the packet with an outer an SVID tag (Service VLAN Identifier tag) newly introduced to the packet and further modifying the packet with an inner CVID tag corresponding to a CVID tag which was received with the packet at an ingress port of the network switch.
 10. The method of claim 9, further comprising: adding the inner CVID tag information to the forwarding database; and validating the inner CVID tag represents a valid dynamic tagged VLAN based on the inner CVID tag information in the forwarding database and based further on compliance with a Virtual Port Profile (VPP).
 11. The method of claim 10, wherein: (a) when the inner CVID tag represents a valid dynamic tagged VLAN, then permitting creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier; or (b) when the inner CVID tag does not represent a valid dynamic tagged VLAN, then dropping the packet received.
 12. The method of claim 11, further comprising: deleting the inner CVID tag information from the forwarding database responsive to successfully creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier.
 13. The method of claim 1, wherein creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier further comprises: creating a MAC entry in the forwarding database for the VLAN created; and distributing the MAC entry for the VLAN created to other modules within the network element.
 14. A network switch comprising: a memory to store processing logic; a processor to execute processing logic; an ingress port to receive a packet having identified therein a source Media Access Control (MAC) address and a Virtual Local Area Network (VLAN) Identifier, wherein the VLAN identifier corresponds to a VLAN which is non-existent on the network switch; software L2-MAC-Learning to modify the packet received to include two VLAN tags, a first VLAN tag corresponding to the VLAN identifier identified within the packet received and a second VLAN tag, distinct from the first; a hardware MAC address search circuit determine that no forwarding database entry exists for the modified packet; and wherein the processing logic is to create the VLAN on the network switch to handle received packets tagged with the VLAN identifier.
 15. The network switch of claim 14: wherein the ingress port of the network switch is serviced by a tagged Virtual Metro Area Network (VMAN) packet catcher at the network switch for packets received having identified therein any VLAN identifier which specifies any VLAN which is non-existent on the network switch; and wherein the software L2-MAC-Learning is to further modify any packet received by the tagged VMAN packet catcher to include an SVID tag (Service VLAN Identifier tag) in addition to a CVID (customer VLAN Identifier tag) already included with such packets.
 16. The network switch of claim 15: wherein the tagged VMAN packet catcher services one or more untagged ingress ports of the network switch; and wherein the network layer 2 MAC address learning mode is enabled for the one or more ingress ports via the software L2-MAC-Learning.
 17. The network switch of claim 14, further comprising: port membership hardware for the ingress port to handle port forwarding for any packet subsequent to the packet received having a VLAN identifier and ingress port combination matching that of the packet received.
 18. The network switch of claim 14, wherein the software L2-MAC-Learning is to modify the packet comprises modifying the packet with an outer an SVID tag (Service VLAN Identifier tag) newly introduced to the packet and further modifying the packet with an inner CVID tag corresponding to a CVID tag which was received with the packet at the ingress port of the network switch.
 19. The network switch of claim 18, wherein the processing logic is to further: add the inner CVID tag information to the forwarding database; and validate the inner CVID tag represents a valid dynamic tagged VLAN based on the inner CVID tag information in the forwarding database and based further on compliance with a Virtual Port Profile (VPP) designating allowable configurations.
 20. The network switch of claim 19, wherein the processing logic is to further: delete the inner CVID tag information from the forwarding database responsive to successfully creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier.
 21. The network switch of claim 14, wherein the processing logic to create the VLAN on the network switch to handle received packets tagged with the VLAN identifier further comprises the processing logic to: create a MAC entry in the forwarding database for the VLAN created; and distribute the MAC entry for the VLAN created to other modules within the network element.
 22. An integrated circuit comprising: an input to receive a packet having identified therein a source Media Access Control (MAC) address and a Virtual Local Area Network (VLAN) Identifier, wherein the VLAN identifier corresponds to a VLAN which is non-existent within a host network switch; a L2-MAC-Learning component to modify the packet received to include two VLAN tags, a first VLAN tag corresponding to the VLAN identifier identified within the packet received and a second VLAN tag, distinct from the first; a hardware MAC address search circuit to determine that no forwarding database entry exists for the modified packet; and a second logic block to create the VLAN within the host network switch to handle received packets tagged with the VLAN identifier.
 23. The integrated circuit of claim 22, wherein the input is coupled to an ingress port of the host network switch to receive the packet; wherein a third logic block is to establish a tagged Virtual Metro Area Network (VMAN) packet catcher at the host network switch to service packets received having identified therein any VLAN identifier which specifies any VLAN which is non-existent on the network switch; and wherein the L2-MAC-Learning component is to further modify any packet received by the tagged VMAN packet catcher to include an SVID tag (Service VLAN Identifier tag) in addition to a CVID (customer VLAN Identifier tag) already included with such packets.
 24. The integrated circuit of claim 22, wherein the integrated circuit is selected from the group comprising: a System On a Chip (SOC) integrated circuit; a Field-programmable Gate Array (FPGA) integrated circuit; an Application-Specific Integrated Circuit (ASIC); and a Programmable Logic Device (PLD) integrated circuit.
 25. A non-transitory computer readable storage medium having instructions stored thereon that, when executed by a processor of a network switch, the instructions cause the network switch to perform operations including: receiving a packet having identified therein a source Media Access Control (MAC) address and a Virtual Local Area Network (VLAN) Identifier, wherein the VLAN identifier corresponds to a VLAN which is non-existent on the network switch; modifying the packet received to include two VLAN tags, a first VLAN tag corresponding to the VLAN identifier identified within the packet received and a second VLAN tag, distinct from the first; determining no forwarding database entry exists for the modified packet; and creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier.
 26. The non-transitory computer readable storage medium of claim 25, wherein the instructions cause the network switch to perform operations further including: creating a tagged Virtual Metro Area Network (VMAN) packet catcher at the network switch for packets received having identified therein any VLAN identifier which specifies any VLAN which is non-existent on the network switch; and modifying any packet received by the tagged VMAN packet catcher to include an SVID tag (Service VLAN Identifier tag) in addition to a CVID (customer VLAN Identifier tag) already included with such packets.
 27. The non-transitory computer readable storage medium of claim 25, wherein modifying the packet received to include two VLAN tags comprises: modifying the packet with an outer an SVID tag (Service VLAN Identifier tag) newly introduced to the packet and further modifying the packet with an inner CVID tag corresponding to a CVID tag which was received with the packet at an ingress port of the network switch.
 28. The non-transitory computer readable storage medium of claim 27, wherein the instructions cause the network switch to perform operations further including: adding the inner CVID tag information to the forwarding database; and validating the inner CVID tag represents a valid dynamic tagged VLAN based on the inner CVID tag information in the forwarding database and based further on compliance with a Virtual Port Profile (VPP).
 29. The non-transitory computer readable storage medium of claim 28, wherein the instructions cause the network switch to perform operations further including: deleting the inner CVID tag information from the forwarding database responsive to successfully creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier.
 30. The non-transitory computer readable storage medium of claim 25, wherein creating the VLAN on the network switch to handle received packets tagged with the VLAN identifier further comprises: creating a MAC entry in the forwarding database for the VLAN created; and distributing the MAC entry for the VLAN created to other modules within the network element. 